@node9/proxy 1.41.0 → 1.43.0

package/README.md

@@ -141,6 +141,23 @@ node9 shield list    # show all shields + status
 - **Auto-undo** — git snapshot before every AI file edit → `node9 undo` to revert
 - **Skills pinning** — SHA-256 verification of installed Claude skills / plugins between sessions
 
+## Review prompts — approve inline, in your agent
+
+When node9 flags an action for **review** (e.g. `git push --force`, a `DROP TABLE`), the approve/deny prompt renders **inline in the agent conversation** — no frozen session, no separate terminal, no hook-timeout race. node9 still runs the full evaluator and makes the decision; only the prompt _surface_ moves to the agent.
+
+- **On by default** for **Claude Code** and **GitHub Copilot CLI** — the agents whose hook contract honors a native `ask`. Every other agent (Codex, Gemini, Antigravity, Hermes, Cursor, OpenCode, Pi) uses node9's own approver.
+- **Control it** with `reviewChannel` in `~/.node9/config.json` (or `--no-ask` on the hook):
+
+```jsonc
+{
+  "settings": {
+    "reviewChannel": "ask", // "ask" = inline agent prompt (default) | "approver" = node9's own approver
+  },
+}
+```
+
+- **Team setups:** when a cloud/team approver is configured (`approvers.cloud: true`), reviews route to that approver instead — node9 won't let an inline self-approval bypass routed/second-party approval.
+
 ## Sandbox — run an agent in a jail
 
 When watching isn't enough, **`node9 sandbox`** runs the agent inside a disposable container with a **kernel-enforced egress allowlist** and **scoped mounts** — while node9's hooks govern and audit every tool call _inside_ the box. The hard version of protection: the agent can only touch the folder you mount and reach the hosts you allow; everything else is dropped at the kernel.

package/dist/cli.js

@@ -298,6 +298,10 @@ var init_config_schema = __esm({
         // node9's own approver (terminal/native/cloud). Unset → smart default
         // (ask for ask-capable agents unless a cloud approver is configured).
         reviewChannel: import_zod.z.enum(["ask", "approver"]).optional(),
+        // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
+        // approver_set). Default (unset/false): those tools refuse over MCP — a human
+        // must run them from the CLI. node9's threat model is the agent itself.
+        mcpAllowWeakening: import_zod.z.boolean().optional(),
         cloudSyncIntervalHours: import_zod.z.number().positive().optional(),
         // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
         // to true; set false to fall back to local-only auditing.
@@ -4203,6 +4207,7 @@ function getConfig(cwd) {
       mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
     if (s.environment !== void 0) mergedSettings.environment = s.environment;
     if (s.reviewChannel !== void 0) mergedSettings.reviewChannel = s.reviewChannel;
+    if (s.mcpAllowWeakening !== void 0) mergedSettings.mcpAllowWeakening = s.mcpAllowWeakening;
     if (s.cloudSyncIntervalHours !== void 0)
       mergedSettings.cloudSyncIntervalHours = s.cloudSyncIntervalHours;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };
@@ -23244,6 +23249,34 @@ function ok(id, result) {
 function err(id, code, message) {
   return JSON.stringify({ jsonrpc: "2.0", id: id ?? null, error: { code, message } });
 }
+var TOOL_CAPABILITY = {
+  // weaken — gated over MCP
+  node9_shield_disable: "weaken",
+  node9_approver_set: "weaken",
+  // add / restorative — always allowed
+  node9_shield_enable: "add",
+  node9_rule_add: "add",
+  // already block/review-only — handleRuleAdd rejects "allow"
+  node9_undo_revert: "add",
+  // restorative
+  // readonly
+  node9_status: "readonly",
+  node9_config_get: "readonly",
+  node9_policy_get: "readonly",
+  node9_audit_get: "readonly",
+  node9_session: "readonly",
+  node9_scan: "readonly",
+  node9_report: "readonly",
+  node9_posture: "readonly",
+  node9_explain: "readonly",
+  node9_shield_list: "readonly",
+  node9_approver_list: "readonly",
+  node9_undo_list: "readonly",
+  node9_undo_detail: "readonly"
+};
+function capabilityOf(tool) {
+  return TOOL_CAPABILITY[tool] ?? "readonly";
+}
 var TOOLS = [
   {
     name: "node9_status",
@@ -23276,7 +23309,7 @@ var TOOLS = [
   },
   {
     name: "node9_shield_disable",
-    description: "Disable a node9 shield. Use node9_shield_list to see currently active shields.",
+    description: 'Disable a node9 shield. WEAKENING action \u2014 refused over MCP by default (a human must run "node9 shield disable <name>" from the CLI). Use node9_shield_list to see active shields.',
     inputSchema: {
       type: "object",
       properties: {
@@ -23295,7 +23328,7 @@ var TOOLS = [
   },
   {
     name: "node9_approver_set",
-    description: "Enable or disable a specific node9 approver channel in the global config (~/.node9/config.json). Use this to turn individual channels on or off without touching other settings. Channels: native, browser, cloud, terminal. WARNING: disabling all approvers means node9 cannot prompt for human approval \u2014 use with care.",
+    description: "Enable or disable a specific node9 approver channel in the global config (~/.node9/config.json). Use this to turn individual channels on or off without touching other settings. Channels: native, browser, cloud, terminal. WEAKENING action \u2014 refused over MCP by default (a human must run it from the CLI). WARNING: disabling all approvers means node9 cannot prompt for human approval \u2014 use with care.",
     inputSchema: {
       type: "object",
       properties: {
@@ -23429,6 +23462,38 @@ var TOOLS = [
       required: []
     }
   },
+  {
+    name: "node9_posture",
+    description: "Run the node9 security posture scorecard for the agent on this host \u2014 grades how exposed the machine is to a compromised agent across isolation, egress, secrets-on-disk, supply chain, and privilege, with the #1 risk and a concrete fix for each finding. Read-only.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        agent: {
+          type: "string",
+          description: "Optional label / policy scope for the agent being graded."
+        }
+      },
+      required: []
+    }
+  },
+  {
+    name: "node9_explain",
+    description: 'Preview exactly how node9 would evaluate a tool call BEFORE running it \u2014 the full allow / review / block waterfall and step-by-step policy trace. Use this to self-check a command (e.g. "git push --force") and see whether it would be allowed, sent for human review, or blocked, and why. Read-only \u2014 nothing executes.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        tool: {
+          type: "string",
+          description: 'Tool name to evaluate. Defaults to "bash" for plain shell commands.'
+        },
+        args: {
+          type: "string",
+          description: 'Tool arguments as JSON, or a plain shell command string (e.g. "git push --force").'
+        }
+      },
+      required: []
+    }
+  },
   {
     name: "node9_rule_add",
     description: 'Add a new protective smart rule to the global node9 config (~/.node9/config.json). Rules can block or send dangerous commands for human review based on regex conditions. IMPORTANT: only "block" and "review" verdicts are permitted \u2014 "allow" rules are never accepted because they would weaken node9 security. Rules can only be added, never removed.',
@@ -23735,6 +23800,17 @@ function handleSessionMcp(args) {
   if (typeof args.detail === "string" && args.detail) cliArgs.push("--detail", args.detail);
   return runCliCommand(cliArgs);
 }
+function handlePostureMcp(args) {
+  const cliArgs = ["posture"];
+  if (typeof args.agent === "string" && args.agent) cliArgs.push("--agent", args.agent);
+  return runCliCommand(cliArgs);
+}
+function handleExplainMcp(args) {
+  const tool = typeof args.tool === "string" && args.tool ? args.tool : "bash";
+  const cliArgs = ["explain", tool];
+  if (typeof args.args === "string" && args.args) cliArgs.push(args.args);
+  return runCliCommand(cliArgs);
+}
 function handleUndoList(args) {
   const cwdFilter = typeof args.cwd === "string" && args.cwd ? args.cwd : null;
   let history = getSnapshotHistory();
@@ -23835,6 +23911,24 @@ function runMcpServer() {
       const p = params ?? {};
       const toolName = p.name;
       const toolArgs = p.arguments ?? {};
+      if (capabilityOf(toolName ?? "") === "weaken") {
+        let allowed = false;
+        try {
+          allowed = getConfig().settings.mcpAllowWeakening === true;
+        } catch {
+          allowed = false;
+        }
+        if (!allowed) {
+          process.stdout.write(
+            err(
+              id,
+              -32e3,
+              `${toolName} weakens node9 and is disabled over MCP. A human must run it from the CLI (e.g. "node9 shield disable <name>"), or set "mcpAllowWeakening": true in ~/.node9/config.json to allow agent-driven weakening.`
+            ) + "\n"
+          );
+          return;
+        }
+      }
       try {
         let text;
         if (toolName === "node9_status") {
@@ -23869,6 +23963,10 @@ function runMcpServer() {
           text = handleReportMcp(toolArgs);
         } else if (toolName === "node9_session") {
           text = handleSessionMcp(toolArgs);
+        } else if (toolName === "node9_posture") {
+          text = handlePostureMcp(toolArgs);
+        } else if (toolName === "node9_explain") {
+          text = handleExplainMcp(toolArgs);
         } else {
           process.stdout.write(err(id, -32601, `Unknown tool: ${toolName}`) + "\n");
           return;

package/dist/cli.mjs

@@ -276,6 +276,10 @@ var init_config_schema = __esm({
         // node9's own approver (terminal/native/cloud). Unset → smart default
         // (ask for ask-capable agents unless a cloud approver is configured).
         reviewChannel: z.enum(["ask", "approver"]).optional(),
+        // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
+        // approver_set). Default (unset/false): those tools refuse over MCP — a human
+        // must run them from the CLI. node9's threat model is the agent itself.
+        mcpAllowWeakening: z.boolean().optional(),
         cloudSyncIntervalHours: z.number().positive().optional(),
         // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
         // to true; set false to fall back to local-only auditing.
@@ -4184,6 +4188,7 @@ function getConfig(cwd) {
       mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
     if (s.environment !== void 0) mergedSettings.environment = s.environment;
     if (s.reviewChannel !== void 0) mergedSettings.reviewChannel = s.reviewChannel;
+    if (s.mcpAllowWeakening !== void 0) mergedSettings.mcpAllowWeakening = s.mcpAllowWeakening;
     if (s.cloudSyncIntervalHours !== void 0)
       mergedSettings.cloudSyncIntervalHours = s.cloudSyncIntervalHours;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };
@@ -23216,6 +23221,34 @@ function ok(id, result) {
 function err(id, code, message) {
   return JSON.stringify({ jsonrpc: "2.0", id: id ?? null, error: { code, message } });
 }
+var TOOL_CAPABILITY = {
+  // weaken — gated over MCP
+  node9_shield_disable: "weaken",
+  node9_approver_set: "weaken",
+  // add / restorative — always allowed
+  node9_shield_enable: "add",
+  node9_rule_add: "add",
+  // already block/review-only — handleRuleAdd rejects "allow"
+  node9_undo_revert: "add",
+  // restorative
+  // readonly
+  node9_status: "readonly",
+  node9_config_get: "readonly",
+  node9_policy_get: "readonly",
+  node9_audit_get: "readonly",
+  node9_session: "readonly",
+  node9_scan: "readonly",
+  node9_report: "readonly",
+  node9_posture: "readonly",
+  node9_explain: "readonly",
+  node9_shield_list: "readonly",
+  node9_approver_list: "readonly",
+  node9_undo_list: "readonly",
+  node9_undo_detail: "readonly"
+};
+function capabilityOf(tool) {
+  return TOOL_CAPABILITY[tool] ?? "readonly";
+}
 var TOOLS = [
   {
     name: "node9_status",
@@ -23248,7 +23281,7 @@ var TOOLS = [
   },
   {
     name: "node9_shield_disable",
-    description: "Disable a node9 shield. Use node9_shield_list to see currently active shields.",
+    description: 'Disable a node9 shield. WEAKENING action \u2014 refused over MCP by default (a human must run "node9 shield disable <name>" from the CLI). Use node9_shield_list to see active shields.',
     inputSchema: {
       type: "object",
       properties: {
@@ -23267,7 +23300,7 @@ var TOOLS = [
   },
   {
     name: "node9_approver_set",
-    description: "Enable or disable a specific node9 approver channel in the global config (~/.node9/config.json). Use this to turn individual channels on or off without touching other settings. Channels: native, browser, cloud, terminal. WARNING: disabling all approvers means node9 cannot prompt for human approval \u2014 use with care.",
+    description: "Enable or disable a specific node9 approver channel in the global config (~/.node9/config.json). Use this to turn individual channels on or off without touching other settings. Channels: native, browser, cloud, terminal. WEAKENING action \u2014 refused over MCP by default (a human must run it from the CLI). WARNING: disabling all approvers means node9 cannot prompt for human approval \u2014 use with care.",
     inputSchema: {
       type: "object",
       properties: {
@@ -23401,6 +23434,38 @@ var TOOLS = [
       required: []
     }
   },
+  {
+    name: "node9_posture",
+    description: "Run the node9 security posture scorecard for the agent on this host \u2014 grades how exposed the machine is to a compromised agent across isolation, egress, secrets-on-disk, supply chain, and privilege, with the #1 risk and a concrete fix for each finding. Read-only.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        agent: {
+          type: "string",
+          description: "Optional label / policy scope for the agent being graded."
+        }
+      },
+      required: []
+    }
+  },
+  {
+    name: "node9_explain",
+    description: 'Preview exactly how node9 would evaluate a tool call BEFORE running it \u2014 the full allow / review / block waterfall and step-by-step policy trace. Use this to self-check a command (e.g. "git push --force") and see whether it would be allowed, sent for human review, or blocked, and why. Read-only \u2014 nothing executes.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        tool: {
+          type: "string",
+          description: 'Tool name to evaluate. Defaults to "bash" for plain shell commands.'
+        },
+        args: {
+          type: "string",
+          description: 'Tool arguments as JSON, or a plain shell command string (e.g. "git push --force").'
+        }
+      },
+      required: []
+    }
+  },
   {
     name: "node9_rule_add",
     description: 'Add a new protective smart rule to the global node9 config (~/.node9/config.json). Rules can block or send dangerous commands for human review based on regex conditions. IMPORTANT: only "block" and "review" verdicts are permitted \u2014 "allow" rules are never accepted because they would weaken node9 security. Rules can only be added, never removed.',
@@ -23707,6 +23772,17 @@ function handleSessionMcp(args) {
   if (typeof args.detail === "string" && args.detail) cliArgs.push("--detail", args.detail);
   return runCliCommand(cliArgs);
 }
+function handlePostureMcp(args) {
+  const cliArgs = ["posture"];
+  if (typeof args.agent === "string" && args.agent) cliArgs.push("--agent", args.agent);
+  return runCliCommand(cliArgs);
+}
+function handleExplainMcp(args) {
+  const tool = typeof args.tool === "string" && args.tool ? args.tool : "bash";
+  const cliArgs = ["explain", tool];
+  if (typeof args.args === "string" && args.args) cliArgs.push(args.args);
+  return runCliCommand(cliArgs);
+}
 function handleUndoList(args) {
   const cwdFilter = typeof args.cwd === "string" && args.cwd ? args.cwd : null;
   let history = getSnapshotHistory();
@@ -23807,6 +23883,24 @@ function runMcpServer() {
       const p = params ?? {};
       const toolName = p.name;
       const toolArgs = p.arguments ?? {};
+      if (capabilityOf(toolName ?? "") === "weaken") {
+        let allowed = false;
+        try {
+          allowed = getConfig().settings.mcpAllowWeakening === true;
+        } catch {
+          allowed = false;
+        }
+        if (!allowed) {
+          process.stdout.write(
+            err(
+              id,
+              -32e3,
+              `${toolName} weakens node9 and is disabled over MCP. A human must run it from the CLI (e.g. "node9 shield disable <name>"), or set "mcpAllowWeakening": true in ~/.node9/config.json to allow agent-driven weakening.`
+            ) + "\n"
+          );
+          return;
+        }
+      }
       try {
         let text;
         if (toolName === "node9_status") {
@@ -23841,6 +23935,10 @@ function runMcpServer() {
           text = handleReportMcp(toolArgs);
         } else if (toolName === "node9_session") {
           text = handleSessionMcp(toolArgs);
+        } else if (toolName === "node9_posture") {
+          text = handlePostureMcp(toolArgs);
+        } else if (toolName === "node9_explain") {
+          text = handleExplainMcp(toolArgs);
         } else {
           process.stdout.write(err(id, -32601, `Unknown tool: ${toolName}`) + "\n");
           return;

package/dist/dashboard.mjs

@@ -2270,6 +2270,10 @@ var init_config_schema = __esm({
         // node9's own approver (terminal/native/cloud). Unset → smart default
         // (ask for ask-capable agents unless a cloud approver is configured).
         reviewChannel: z.enum(["ask", "approver"]).optional(),
+        // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
+        // approver_set). Default (unset/false): those tools refuse over MCP — a human
+        // must run them from the CLI. node9's threat model is the agent itself.
+        mcpAllowWeakening: z.boolean().optional(),
         cloudSyncIntervalHours: z.number().positive().optional(),
         // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
         // to true; set false to fall back to local-only auditing.

package/dist/index.js

@@ -283,6 +283,10 @@ var ConfigFileSchema = import_zod.z.object({
     // node9's own approver (terminal/native/cloud). Unset → smart default
     // (ask for ask-capable agents unless a cloud approver is configured).
     reviewChannel: import_zod.z.enum(["ask", "approver"]).optional(),
+    // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
+    // approver_set). Default (unset/false): those tools refuse over MCP — a human
+    // must run them from the CLI. node9's threat model is the agent itself.
+    mcpAllowWeakening: import_zod.z.boolean().optional(),
     cloudSyncIntervalHours: import_zod.z.number().positive().optional(),
     // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
     // to true; set false to fall back to local-only auditing.
@@ -3737,6 +3741,7 @@ function getConfig(cwd) {
       mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
     if (s.environment !== void 0) mergedSettings.environment = s.environment;
     if (s.reviewChannel !== void 0) mergedSettings.reviewChannel = s.reviewChannel;
+    if (s.mcpAllowWeakening !== void 0) mergedSettings.mcpAllowWeakening = s.mcpAllowWeakening;
     if (s.cloudSyncIntervalHours !== void 0)
       mergedSettings.cloudSyncIntervalHours = s.cloudSyncIntervalHours;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };

package/dist/index.mjs

@@ -253,6 +253,10 @@ var ConfigFileSchema = z.object({
     // node9's own approver (terminal/native/cloud). Unset → smart default
     // (ask for ask-capable agents unless a cloud approver is configured).
     reviewChannel: z.enum(["ask", "approver"]).optional(),
+    // When true, agents may call WEAKENING node9 MCP tools (shield_disable,
+    // approver_set). Default (unset/false): those tools refuse over MCP — a human
+    // must run them from the CLI. node9's threat model is the agent itself.
+    mcpAllowWeakening: z.boolean().optional(),
     cloudSyncIntervalHours: z.number().positive().optional(),
     // Outbox shipper (audit.log → SaaS batch ingest). enabled defaults
     // to true; set false to fall back to local-only auditing.
@@ -3707,6 +3711,7 @@ function getConfig(cwd) {
       mergedSettings.approvalTimeoutMs = s.approvalTimeoutSeconds * 1e3;
     if (s.environment !== void 0) mergedSettings.environment = s.environment;
     if (s.reviewChannel !== void 0) mergedSettings.reviewChannel = s.reviewChannel;
+    if (s.mcpAllowWeakening !== void 0) mergedSettings.mcpAllowWeakening = s.mcpAllowWeakening;
     if (s.cloudSyncIntervalHours !== void 0)
       mergedSettings.cloudSyncIntervalHours = s.cloudSyncIntervalHours;
     if (s.hud !== void 0) mergedSettings.hud = { ...mergedSettings.hud, ...s.hud };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "1.41.0",
+  "version": "1.43.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",